As reported by BleepingComputer, Arista Networks has disclosed a critical zero-day vulnerability in its VeloCloud Orchestrator (VCO) platform that is already being exploited in the wild. This is not a theoretical risk — adversary infrastructure and indicators of compromise have already been published, and CISA has imposed a federal remediation deadline of September 25, 2026.
Vulnerability Summary
| Field | Detail |
|---|---|
| CVE Identifier | CVE-2026-93952 |
| Severity | Critical (Maximum Severity) |
| Root Cause | Improper input validation |
| Attack Vector | Network access to VCO web interface; requires public portion of VeloCloud Edge authentication certificate |
| Authentication Required | No — VCO tenant/operator credentials not required |
| User Interaction | None |
| Exploitation Complexity | Low |
| Active Exploitation | Yes — confirmed in the wild |
| Affected Products | Arista VeloCloud Orchestrator (VCO) On-Prem deployments with certificate-based Edge-to-VCO authentication |
| Patched Versions | VCO 5.2.3.16+, VCO 6.4.2.8+ (hosted deployments already patched); patches pending for VCO 6.1.3.7 and below, VCO 7.0.0.2 and below |
Why This Matters
The attack surface here is the SD-WAN management plane — the central nervous system for branch network configurations across potentially hundreds of edge devices. Compromising VCO doesn't just affect one box; it gives an attacker a position from which to manipulate routing policy, push malicious configurations to edge devices, and potentially pivot into the internal networks of every branch the orchestrator manages. The fact that no operator or tenant credentials are required, combined with the public availability of the required certificate material, makes this an attractive target for both criminal and state-aligned actors.
What elevates the concern is the certificate exposure model. The attack only requires the public portion of the VeloCloud Edge authentication certificate — not a private key. This means the barrier to entry is dramatically lower than defenders might assume for a certificate-based authentication deployment. Any environment where that public certificate has been exposed, shared, or is otherwise retrievable becomes immediately exploitable.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Inventory and patch priority: Identify all VCO on-prem instances across your environment. Upgrade to VCO 5.2.3.16+, 6.4.2.8+, or the latest available patched release for your branch. If a patch is not yet available for your version (6.1.3.7 and below, 7.0.0.2 and below), engage Arista TAC for interim guidance.
- Restrict VCO web interface exposure: Immediately limit network access to the VCO web interface to administrative management VLANs only. Remove any internet-facing exposure. Implement allow-list ACLs at the network layer.
- Hunt for compromise before remediating: If there is any chance your environment has been accessed, preserve logs before wiping or patching. Review VCO web access logs, nginx logs, backend application logs, system logs, database logs, and filesystem timestamps for anomalous activity.
- Deploy detection signatures: Monitor nginx logs for the
x-vc-optHTTP header — a specific indicator called out by Arista. Alert on requests containing encoded characters, unusual URL-like path components, or references to local/internal services. Flag unexpected outbound HTTP/HTTPS traffic originating from the VCO host itself. - Block known-bad infrastructure: Block
142.93.149.77and104.248.126.159at perimeter egress controls. These IPs are associated with observed exploitation activity. - Review recent admin activity: Check for unauthorized configuration changes pushed to edge devices — including routing modifications, tunnel additions, or new certificate enrollments — that could indicate attacker persistence.
- Assess certificate exposure: Determine whether the public portion of your VeloCloud Edge authentication certificate has been exposed through prior incidents, shared documentation, or misconfigured repositories. Rotate certificates where exposure is suspected.
Broader Implications
SD-WAN orchestration platforms represent a blind spot in many organizations' threat models. Security teams obsess over endpoints and cloud workloads but often treat the network management plane as infrastructure plumbing rather than a high-value target. This vulnerability should be a wake-up call — the orchestrator is the crown jewel of any SD-WAN deployment, and its compromise can cascade across an entire branch network architecture.
Defenders should use this event as an opportunity to map all SD-WAN management interfaces in their environment, verify that they are properly segmented, and ensure that logging and detection coverage extends to these critical control systems. The CISA KEV inclusion confirms the federal government considers this a national-level risk — every organization running VeloCloud should treat it accordingly, regardless of sector.
